[VPN] Re: LAN-to-LAN with Overlapping networks and PAT - Network

This is a discussion on [VPN] Re: LAN-to-LAN with Overlapping networks and PAT - Network ; Siddhartha Jain yahoo.co.uk> writes:
>
> Hello,
>
> I am trying to get a LAN-to-LAN IPSec VPN to work.
>
> Site A is 10.250.0.0/16
> Site B is 10.0.0.0./8
>
> On Site A, the inside network accesses ...

[VPN] Re: LAN-to-LAN with Overlapping networks and PAT

Siddhartha Jain yahoo.co.uk> writes:
>
> Hello,
>
> I am trying to get a LAN-to-LAN IPSec VPN to work.
>
> Site A is 10.250.0.0/16
> Site B is 10.0.0.0./8
>
> On Site A, the inside network accesses the internet by
> being PAT-ted to a pool of four global IP addresses -
> 64.aa.bb.cc/29
>
> Site B has NAT-ted the hosts to be connected to over
> the VPN with 192.168.40.0/24
>
> Now my question is that how do I configure Site A
> router wrt to NAT.
>
> Will it work if I leave the PAT on Site A as it is and
> define my interesting traffic as:
> access-list 190 permit ip 64.aa.bb.cc 0.0.0.8 host
> 192.168.40.1
>
> The PAT on site A is defined as:
> ip nat pool tcsux 64.aa.bb.c1 64.aa.bb.c4
> prefix-length 29
> ip nat inside source list 163 pool tcsux overload
>
> On Site B, the interesting traffic would then be
> between 192.168.40.0/24 and 64.aa.bb.cc/29
>
> Will this work? Ofcourse, I can punch in the config
> and see if it works but unfortunately Site B isn't
> under my command so I need to suggest the config to
> the Site B admin.
>
> Thanks,
>
> Siddhartha Jain (CISSP)
>
> My Gear: Canon Digital 300D with Canon 18-55mm f/3.5-5.6
> : Minolta Maxxum 5 with Tamron 28-200mm f/3.8-5.6 Super LD IF
> : Pentax M42 mount Super-Takumar 50mm f/1.4
> : Jupiter M42 mount 200mm 21m f4
> : Mahindra Bolero GLX
>
> The Bombay Amateur Photographers Club
> http://groups.yahoo.com/group/tbapc/
>
> Mahindra & Mahindra Jeepers
> http://autos.groups.yahoo.com/group/mmjeeps/
>
> Send instant messages to your online friends http://uk.messenger.yahoo.com
>

Hi, with a site to site tunnel, you need to avoid NAT when communicating with
the remote peer and remote networks. Also, you should setup rules to allow
traffic between the internal nets locally and remote....not external nets. So,
you would have an ACL allowing all traffic to go bidirectional from
10.250.0.0/16 to 10.0.0.0/8,192.168.40.0/24; then just make sure you have
static routes setup for the remote networks.

The PAT is fine as long as it does not apply to the remote peer gateway or
remote networks. All traffic except the needed tunnel traffic should hide
behind the PAT....so basically all networks except the 10.250.0.0/16 network
should hide behind the PAT on Site A.

Configuring Site A wrt the NAT:
If you don't have control over the NAT (like with an ISP), you can turn
on "Enable NAT-T transversal" on Site A. With this enabled, you will
have innacurate monitoring of the Site B interface that's NAT'd. It will
report the tunnel is down alot, when it's still up. But, the tunnel will work
fine.

I don't believe that leaving the PAT on Site A will work. For one thing, Site
A is not going to be able to talk to the 192.168.40.0/24 network until the
tunnel is built. And, the ACLs/policies are validated first...before Phase 1
IKE even starts. So, you need to have Site B's public IP...or use the first
hop (outbound)for Site B. Make sure Site B Admin is allowing the tunnel
traffic to pass through the router/gateway that leads to the 192.168.40.0
network. UDP 500, UDP 4500, TCP 500, TCP 10000, UDP 10000, IP51, IP47